Guidance for Identifying, Addressing and Reporting 
Cybersecurity Work Roles of Critical Need 


Introduction 

The Federal Cybersecurity Workforce Assessment Act of December 2015 (Act) requires the 
Federal Government to identify and code positions with information technology, cybersecurity 
and other cyber-related functions. The codes represent Work Roles described in the National 
Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework. After 
positions are identified and coded, the Act then requires Federal agencies to identify and report 
information technology, cybersecurity and other cyber-related Work Roles of Critical Need. The 
following guidance provides agencies with instructions for meeting this requirement. 

Overview 


WHAT IS REQUIRED ? 1 

WHEN ? 2 

The U.S. Office of Personnel Management (OPM) will provide 
guidance for agencies to identify information technology, cybersecurity 
and other cyber-related roles of critical need, including current roles 
with acute skill shortages and roles with emerging skill shortages. 

April 2018 3 

Each agency will: 

1) identify information technology, cybersecurity and other cyber- 
related work roles of critical need in the workforce; and 

2) submit a report to OPM describing the roles identified and 
substantiating the critical need designation. 

April 2019-2022 
(annually) 


*’ 2 The listed requirements and timelines are specified in Section 304 of the Act. 

3 The Act instructs OPM to provide this guidance in a timely manner, but does not establish a due date. OPM set a 
target date of April 2018 to issue the guidance. 








HOW? 


■ OPM consulted with stakeholders in establishing Governmentwide guidance for 
agencies to use in determining and reporting their Work Roles of Critical Need. 

■ Using the guidance, Human Resources and Chief Information Office, staff will work 
together to identify an agency’s specific Work Roles of Critical Need and then take 
action to mitigate skill shortages in those Work Roles of Critical Need. It is anticipated 
Work Roles of Critical Need will vary based upon agencies’ missions and priorities. 

■ Agencies will annually report to OPM beginning 2019 through 2022 on their Work 
Roles of Critical Need and progress in mitigating skill shortages, in accordance with the 
instructions provided below and additional reporting guidance posted on the Federal 
Cybersecurity Workforce Assessment Act (FCWAA) MAX website . OPM will collect 
agencies’ Work Roles of Critical Needs and identify common needs to address from the 
Governmentwide perspective. 


Instructions 4 


STEPS 1-3: COMPLETE AND REPORT BY APRIL 2019 


STEP 1 

Identify Work Roles of Critical Need 

■ An agency determines their Work Roles of Critical Need. 

o “Work Roles” are those described by OPM’s new, 3-digit cybersecurity codes, 
which were derived from National Institute of Standards and Technology 
(NIST) Special Publication 800-181, NICE Cybersecurity Workforce 
Framework. 

o “Work Roles of Critical Need” are Work Roles deemed by the agency as 
having: 


4 Departments with components have discretion in applying the reporting aspects of the Instructions. They may 
report consolidated information from among their components into one department-wide report, or they may report 
individual component information. All reporting to OPM will be done through the department level. Additional 
guidance will be posted on the FCWAA MAX website . Reporting deadlines in the Instructions apply to the civilian 
workforce and not the non-civilian workforce. 
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■ Greatest skill shortages, in terms of: 1) staffing levels and/or 
proficiency/competency levels and 2) current and emerging shortages; 
AND 

■ Mission criticality or importance (i.e., critical to meeting the agency’s 
most significant organizational missions, priorities, challenges, etc.). 

o An agency may follow their workforce planning process to determine the Work 
Roles of Critical Need. 

■ An agency reports to OPM their list 5 of Work Roles of Critical Need, including 
information to substantiate the designation, by April 2019. Additional guidance for 
developing this report, including a reporting template, will be posted on the FCWAA 
MAX website . 

STEP 2 

Determine Root Causes of Shortages in Work Roles of Critical Need 

■ An agency determines the root causes of the skill shortages in their identified Work 
Roles of Critical Need. Root causes may involve a range of issues, such as (but not 
limited to): 

o Talent pipeline, 
o Recruitment and outreach, 
o Hiring, 
o Retention, 

o Development and training, 
o Performance management, or 
o Resources and budget. 

STEP 3 

Develop Action Plan with Metrics and Targets to Address and Mitigate Root Causes and 
Shortages in Work Roles of Critical Need 

■ An agency: 

o Develops an action plan to address and mitigate the root causes identified in 
their Work Roles of Critical Need; and 


5 Although the Act calls for agencies to describe in their report the Work Roles of Critical Need they identify, 
descriptions of Work Roles are already contained in the NICE Cybersecurity Workforce Framework and OPM 
cybersecurity coding documents. Therefore, OPM only needs a list of the Work Roles of Critical Need from 
agencies and not descriptions of the Work Roles of Critical Need. 
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o Establishes metrics and targets for gauging success in mitigating the root causes 
and shortages in Work Roles of Critical Need and/or improving or 
strengthening the Work Roles of Critical Need. 

■ An agency submits to OPM their action plan with metrics and targets, based upon the 
root causes identified, by April 2019. 

■ Additional reporting guidance will be posted on the FCWAA MAX website . 


STEP 4: AS APPROPRIATE, APRIL 2020 AND ONGOING 


STEP 4 

Update Work Roles of Critical Need, Root Cause Analysis, Action Plan, Metrics and 
Targets (As Appropriate, April 2020 and Ongoing) 

■ An agency periodically reevaluates their Work Roles of Critical Need to ensure they 
are up to date. Any newly-identified Work Roles of Critical Need will necessitate a 
root cause analysis and potentially, revisions to the agency’s action plan, metrics and 
targets. 

■ An agency may need to make revisions to their action plan, metrics and targets to keep 
them appropriately focused. 

■ An agency immediately reports to OPM any changes to their list of Work Roles of 
Critical Need, action plan, metrics or targets. 


STEP 5: REPORT ON PROGRESS ANNUALLY APRIL 2020-2022 


STEP 5 

Mitigate Shortages in Work Roles of Critical Need 

■ An agency monitors, documents and ensures progress against their action plan, metrics 
and targets. 

■ “Progress” is viewed as success in mitigating shortages in Work Roles of Critical Need 
and/or improving or strengthening Work Roles of Critical Need. 

■ An agency reports to OPM progress against their action plan, metrics and targets 
annually beginning April 2020 through 2022. 

■ Additional reporting guidance will be posted on the FCWAA MAX website . 


4 










FUTURE NEXT STEP (Date TBD) 


FUTURE NEXT STEP 

Gain Agency and Governmentwide Views of Work Roles of Critical Need Vacancies 

■ An agency will periodically report to OPM their Work Roles of Critical Need 
vacancies based upon guidance provided in the near future. 


SUMMARY OF REQUIREMENTS 
TO ANNUALLY REPORT TO OPM DURING 2019-2022 


REPORTING REQUIREMENTS 

Additional reporting guidance and templates will be posted on the FCWAA MAX website . 

■ April 2019: 

An agency reports to OPM their list of Work Roles of Critical Need, including 
information to substantiate the designation. 

An agency reports to OPM their action plan with metrics and targets based upon the 
root cause analysis of skill shortages in their Work Roles of Critical Need. 

■ April 2020: An agency reports to OPM progress against their action plan, metrics and 
targets. This documents how the agency is mitigating shortages in their Work Roles of 
Critical Need and/or improving or strengthening their Work Roles of Critical Need. 

■ April 2021: An agency reports to OPM progress against their action plan, metrics and 
targets. This documents how the agency is mitigating shortages in their Work Roles of 
Critical Need and/or improving or strengthening their Work Roles of Critical Need. 

■ April 2022: An agency reports to OPM progress against their action plan, metrics and 
targets. This documents how the agency is mitigating shortages in their Work Roles of 
Critical Need and/or improving or strengthening their Work Roles of Critical Need. 
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RESOURCES 


Federal Cybersecurity Workforce Assessment Act: 

httpsd/www.congress.gov/l 14/plaws/publl 13/PLAW-l 14publl 13.pdf (pages 735-737) 

U.S. Department of Homeland Security (DHS) / National Initiative for Cybersecurity Careers 
and Studies (NICCS) Workforce Development Toolkit: https://niccs.us- 

cert.gov/sites/default/fdes/documents/pdf/cvbersecuritv workforce development toolkit.pdf?tra 

ckDocs=cvbersecurity workforce development toolkit.pdf 

OPM Workforce Planning Best Practices Guide: https://www.opm.gov/services-for-agencies/hr- 
line-of-business/migration-planning-guidance/workforce-planning-best-practices.pdf 

OPM Scenario-Based Workforce Planning: https://www.opm.gov/policy-data-oversight/human- 
capital-management/reference-materials/tools/scenario-based-workforce-planning.pdf 

Resources on Federal Cybersecurity Workforce Assessment Act MAX website: 
https://communitv.max.gov/pages/viewpage.action?spaceKev=HumanCapital&title=Cybersecuri 

ty+Workforce+Assessment+Law 

Description of Work Roles and 3-Digit Cybersecurity Codes (within the Federal Cybersecurity 
Coding Structure, Table l, Pages 4-11): https://www.nist.gov/fde/394236 

NICE Cybersecurity Workforce Framework: https://www.nist.gov/itl/applied- 
cybersecuritv/national-initiative-cybersecuritv-education-nice/nice-cybersecuritv 

DHS/NICCS Framework Interactive Tool: https://niccs.us-cert.gov/workforce- 
development/cyber-security-workforce-framework 


6 

















